release-artifacts.yml

name: Release Artifacts

on:
  pull_request:
    paths:
      - ".github/workflows/release-artifacts.yml"
      - "examples/release-artifacts-smoke.py"
      - "loopx/**"
      - "package.json"
      - "package-lock.json"
      - "pyproject.toml"
      - "README.md"
      - "scripts/release_artifacts.py"
      - "tsconfig.control-plane.json"
  release:
    types: [published]
  workflow_dispatch:
    inputs:
      tag:
        description: "Existing GitHub Release tag containing this release tooling"
        required: true
        type: string

permissions:
  contents: read

concurrency:
  group: release-artifacts-${{ github.event.release.tag_name || inputs.tag || github.ref }}
  cancel-in-progress: false

jobs:
  build:
    if: github.repository == 'huangruiteng/loopx'
    runs-on: ubuntu-latest
    timeout-minutes: 20
    permissions:
      contents: read
      id-token: write
      attestations: write
    outputs:
      release-tag: ${{ steps.identity.outputs.release-tag }}
    steps:
      - name: Check out release source
        uses: actions/checkout@v7
        with:
          fetch-depth: 0
          ref: ${{ github.event.release.tag_name || inputs.tag || github.sha }}

      - name: Set up Python
        uses: actions/setup-python@v6
        with:
          python-version: "3.11"
          cache: pip

      - name: Set up the packaged TypeScript control-plane runtime
        uses: actions/setup-node@v6
        with:
          node-version: "22.6"

      - name: Resolve and validate release identity
        id: identity
        env:
          EVENT_RELEASE_TAG: ${{ github.event.release.tag_name }}
          INPUT_RELEASE_TAG: ${{ inputs.tag }}
        run: |
          set -euo pipefail
          release_tag="${EVENT_RELEASE_TAG:-${INPUT_RELEASE_TAG:-}}"
          if [[ -z "${release_tag}" ]]; then
            release_tag="$(python scripts/release_artifacts.py expected-tag)"
          fi
          python scripts/release_artifacts.py validate-tag "${release_tag}"
          source_date_epoch="$(git show -s --format=%ct HEAD)"
          echo "release-tag=${release_tag}" >> "${GITHUB_OUTPUT}"
          echo "RELEASE_TAG=${release_tag}" >> "${GITHUB_ENV}"
          echo "SOURCE_DATE_EPOCH=${source_date_epoch}" >> "${GITHUB_ENV}"
          echo "PYTHONHASHSEED=0" >> "${GITHUB_ENV}"

      - name: Install release build tools
        run: python -m pip install --disable-pip-version-check build==1.4.4 twine==6.2.0

      - name: Build wheel and source distribution
        run: python -m build --sdist --wheel --outdir dist/packages

      - name: Normalize source distribution metadata
        run: >-
          python scripts/release_artifacts.py normalize-sdist
          --dist-dir dist/packages
          --source-date-epoch "${SOURCE_DATE_EPOCH}"

      - name: Validate package metadata
        run: python -m twine check dist/packages/*

      - name: Generate and verify checksums
        run: |
          set -euo pipefail
          python scripts/release_artifacts.py write-checksums \
            --dist-dir dist/packages \
            --output dist/SHA256SUMS
          python scripts/release_artifacts.py verify-checksums \
            --dist-dir dist/packages \
            --checksum-file dist/SHA256SUMS

      - name: Verify wheel in a clean environment
        run: |
          set -euo pipefail
          python -m venv "${RUNNER_TEMP}/loopx-wheel"
          "${RUNNER_TEMP}/loopx-wheel/bin/python" -m pip install \
            --disable-pip-version-check \
            --no-deps \
            dist/packages/*.whl
          test "$("${RUNNER_TEMP}/loopx-wheel/bin/loopx" --version)" = \
            "loopx ${RELEASE_TAG#v}"
          "${RUNNER_TEMP}/loopx-wheel/bin/python" - <<'PY'
          from loopx.control_plane.effect_program import SettlementIdentity
          from loopx.control_plane.effect_runtime import (
              collect_effect_runtime_readiness,
          )
          from loopx.control_plane.turn_driver.turn_journal_runtime import (
              interpret_turn_journal_projection,
              write_turn_journal,
          )
          from pathlib import Path
          from tempfile import TemporaryDirectory

          turn_key = "sha256:" + "a" * 64
          journal_identity = SettlementIdentity(
              goal_id="fixture-goal",
              agent_id="fixture-agent",
              todo_id="fixture-todo",
              turn_instance_id=turn_key,
          )
          journal = {
              "schema_version": "loopx_turn_journal_v0",
              "goal_id": "fixture-goal",
              "turn_key": turn_key,
              "status": "committed",
              "completed_phases": [
                  "host_execute",
                  "typed_result",
                  "validation",
                  "durable_writeback",
                  "quota_spend",
                  "scheduler_apply",
                  "scheduler_ack",
              ],
              "plan": {
                  "turn_envelope": {
                      "goal_id": "fixture-goal",
                      "agent_id": "fixture-agent",
                      "action": {
                          "selected_todo": {"todo_id": "fixture-todo"},
                      },
                  },
                  "transaction": {
                      "turn_key": turn_key,
                      "settlement_plan": {
                          "schema_version": "quota_settlement_plan_v1",
                          "identity": journal_identity.as_dict(),
                      },
                  },
              },
          }
          result = interpret_turn_journal_projection(
              journal,
              goal_id="fixture-goal",
              agent_id="fixture-agent",
              turn_key=turn_key,
          )
          assert result["decision"] == "replay_legal", result
          assert result["effects"] == [], result
          identity = SettlementIdentity(
              goal_id="fixture-goal",
              agent_id="fixture-agent",
              todo_id="fixture-todo",
              turn_instance_id="fixture-turn",
          )
          assert identity.effect_id == (
              "fixture-goal:fixture-agent:fixture-todo:fixture-turn"
          ), identity
          readiness = collect_effect_runtime_readiness(deep=True)
          assert readiness["status"] == "ready", readiness
          assert readiness["semantic_probe"] == "passed", readiness
          with TemporaryDirectory() as temporary_directory:
              effect_id = journal_identity.effect_id
              writable_journal = {
                  **journal,
                  "status": "in_progress",
                  "completed_phases": [],
              }
              committed = write_turn_journal(
                  str(Path(temporary_directory) / "turn.json"),
                  writable_journal,
                  expected_effect_id=effect_id,
              )
              assert committed["appended"] is True, committed
              assert committed["replayed"] is False, committed
          PY

      - name: Verify wheel through the DSH managed-runtime install shape
        run: |
          set -euo pipefail
          target="${RUNNER_TEMP}/loopx-wheel-target"
          skills_dir="${RUNNER_TEMP}/loopx-wheel-target-skills"
          python -m pip install \
            --disable-pip-version-check \
            --no-deps \
            --target "${target}" \
            dist/packages/*.whl
          (
            cd "${RUNNER_TEMP}"
            PYTHONPATH="${target}" python -m loopx.cli --format json \
              workflow-skills --skills-dir "${skills_dir}" \
              --host-surface deepseek-harness-native \
              > "${RUNNER_TEMP}/loopx-wheel-target-inspect.json"
          )
          python - "${RUNNER_TEMP}/loopx-wheel-target-inspect.json" <<'PY'
          import json
          from pathlib import Path
          import sys

          payload = json.loads(Path(sys.argv[1]).read_text(encoding="utf-8"))
          assert payload["ok"] is True, payload
          assert payload["operation"] == "inspect", payload
          assert payload["host_surface"] == "deepseek-harness-native", payload
          assert payload["source"]["kind"] == "python_distribution", payload
          assert payload["install_required"] is True, payload
          PY
          export CODEX_HOME="${RUNNER_TEMP}/loopx-wheel-codex"
          skills_dir="${CODEX_HOME}/skills"
          "${RUNNER_TEMP}/loopx-wheel/bin/loopx" --format json \
            workflow-skills --install --skills-dir "${skills_dir}" \
            > "${RUNNER_TEMP}/loopx-workflow-skills-install.json"
          "${RUNNER_TEMP}/loopx-wheel/bin/python" - \
            "${RUNNER_TEMP}/loopx-workflow-skills-install.json" <<'PY'
          import json
          from pathlib import Path
          import sys

          payload = json.loads(Path(sys.argv[1]).read_text(encoding="utf-8"))
          assert payload["ok"] is True, payload
          assert payload["source"]["kind"] == "python_distribution", payload
          assert payload["after"]["ready"] is True, payload
          PY
          conflicting_bin="${RUNNER_TEMP}/loopx-conflicting-bin"
          mkdir -p "${conflicting_bin}"
          ln -s /usr/bin/false "${conflicting_bin}/loopx"
          PATH="${conflicting_bin}:${PATH}" \
            "${RUNNER_TEMP}/loopx-wheel/bin/loopx" --format json \
            doctor --deep > "${RUNNER_TEMP}/loopx-wheel-doctor.json"
          "${RUNNER_TEMP}/loopx-wheel/bin/python" - \
            "${RUNNER_TEMP}/loopx-wheel-doctor.json" <<'PY'
          import json
          from pathlib import Path
          import sys

          payload = json.loads(Path(sys.argv[1]).read_text(encoding="utf-8"))
          assert payload["ok"] is True, payload
          assert payload["package"]["install_kind"] == "python_distribution", payload
          assert payload["path"]["loopx"] != payload["path"]["current_invocation"]
          validation = payload["release_candidate"]
          checks = {item["id"]: item for item in validation["checks"]}
          assert validation["schema_version"] == "loopx_python_distribution_checks_v0"
          assert checks["command_package_same_distribution"]["ok"] is True, payload
          assert checks["representative_distribution_paths"]["ok"] is True, payload
          assert "scripts/loopx" not in validation["representative_cli"][
              "package_paths"
          ]["required"]
          PY
          "${RUNNER_TEMP}/loopx-wheel/bin/loopx" --format json \
            workflow-skills --uninstall --skills-dir "${skills_dir}" \
            > "${RUNNER_TEMP}/loopx-workflow-skills-uninstall.json"
          "${RUNNER_TEMP}/loopx-wheel/bin/python" - \
            "${RUNNER_TEMP}/loopx-workflow-skills-uninstall.json" <<'PY'
          import json
          from pathlib import Path
          import sys

          payload = json.loads(Path(sys.argv[1]).read_text(encoding="utf-8"))
          assert payload["ok"] is True, payload
          assert sorted(payload["result"]["removed"]) == [
              "loopx",
              "loopx-benchmark",
              "loopx-doc-registry",
              "loopx-pr-program",
              "loopx-pr-review",
              "loopx-project",
              "loopx-self-repair",
          ], payload
          PY

      - name: Exercise release contract smoke
        run: python examples/release-artifacts-smoke.py

      - name: Attest release packages and checksum manifest
        if: github.event_name != 'pull_request'
        uses: actions/attest@v4
        with:
          subject-path: |
            dist/packages/*
            dist/SHA256SUMS

      - name: Upload validated release bundle
        uses: actions/upload-artifact@v7
        with:
          name: loopx-${{ steps.identity.outputs.release-tag }}
          path: dist
          if-no-files-found: error
          retention-days: 30

  upload-release:
    if: github.event_name != 'pull_request'
    needs: build
    runs-on: ubuntu-latest
    timeout-minutes: 10
    permissions:
      contents: write
    steps:
      - name: Check out release source
        uses: actions/checkout@v7
        with:
          ref: ${{ needs.build.outputs.release-tag }}

      - name: Download validated release bundle
        uses: actions/download-artifact@v7
        with:
          name: loopx-${{ needs.build.outputs.release-tag }}
          path: dist

      - name: Verify checksums before upload
        run: >-
          python scripts/release_artifacts.py verify-checksums
          --dist-dir dist/packages
          --checksum-file dist/SHA256SUMS

      - name: Upload immutable GitHub Release assets
        env:
          GH_TOKEN: ${{ github.token }}
          RELEASE_TAG: ${{ needs.build.outputs.release-tag }}
        run: |
          set -euo pipefail
          gh release view "${RELEASE_TAG}" --repo "${GITHUB_REPOSITORY}" >/dev/null
          gh release upload "${RELEASE_TAG}" \
            dist/packages/* \
            dist/SHA256SUMS \
            --repo "${GITHUB_REPOSITORY}"

  publish-pypi:
    if: >-
      github.event_name != 'pull_request' &&
      vars.PYPI_PUBLISH_ENABLED == 'true'
    needs:
      - build
      - upload-release
    runs-on: ubuntu-latest
    timeout-minutes: 10
    permissions:
      id-token: write
    environment:
      name: pypi
      url: https://pypi.org/project/loopx/
    steps:
      - name: Download validated release bundle
        uses: actions/download-artifact@v7
        with:
          name: loopx-${{ needs.build.outputs.release-tag }}
          path: dist

      - name: Publish distributions with PyPI Trusted Publishing
        uses: pypa/gh-action-pypi-publish@dc37677b2e1c63e2034f94d8a5b11f265b73ba33 # release/v1
        with:
          packages-dir: dist/packages

      - name: Verify the published package from PyPI
        env:
          RELEASE_TAG: ${{ needs.build.outputs.release-tag }}
        run: |
          set -euo pipefail
          version="${RELEASE_TAG#v}"
          verify_target="${RUNNER_TEMP}/loopx-pypi-target-${version}"
          skills_dir="${RUNNER_TEMP}/loopx-pypi-skills-${version}"
          for attempt in {1..12}; do
            if python -m pip install \
              --disable-pip-version-check \
              --index-url https://pypi.org/simple \
              --no-cache-dir \
              --no-deps \
              --target "${verify_target}" \
              "loopx==${version}"; then
              if (
                cd "${RUNNER_TEMP}"
                test "$(PYTHONPATH="${verify_target}" python -m loopx.cli --version)" = \
                  "loopx ${version}"
                PYTHONPATH="${verify_target}" python -m loopx.cli --format json \
                  workflow-skills --install --skills-dir "${skills_dir}" \
                  --host-surface deepseek-harness-native \
                  > "${RUNNER_TEMP}/loopx-pypi-workflow-skills.json"
              ); then
                python - "${RUNNER_TEMP}/loopx-pypi-workflow-skills.json" <<'PY'
          import json
          from pathlib import Path
          import sys

          payload = json.loads(Path(sys.argv[1]).read_text(encoding="utf-8"))
          assert payload["ok"] is True, payload
          assert payload["operation"] == "install", payload
          assert payload["host_surface"] == "deepseek-harness-native", payload
          assert payload["source"]["kind"] == "python_distribution", payload
          assert payload["after"]["ready"] is True, payload
          PY
                exit 0
              fi
            fi
            if [[ "${attempt}" -eq 12 ]]; then
              break
            fi
            echo "PyPI has not exposed loopx ${version} yet; retrying in 10 seconds"
            sleep 10
          done
          echo "loopx ${version} is still not installable from PyPI" >&2
          exit 1